231bbb5c3a62a93eb1e67083a1d60a4c9b264cf5b723b98ad00751952674c53f

Analysis

max time kernel
139s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c61dda2091051594a6103c86222a97e_JaffaCakes118.exe
Size

113KB
MD5

5c61dda2091051594a6103c86222a97e
SHA1

d672b7fe98d34b4d517e2cbc1713c31432aed808
SHA256

231bbb5c3a62a93eb1e67083a1d60a4c9b264cf5b723b98ad00751952674c53f
SHA512

5978b07f488cda223616157ac285358a6b2ced811e16da01af37a4e1d3b2ec7426ac87152af2c7e26c604825e518001613bb34486fb96aebdad8620b3c5b6565
SSDEEP

1536:zeBu/Z45Rge80ST/TR5oi9emtmSvxWTHKKEsKtcv6+sh1MK/IM9IWDXFIb:PcRg8Or1emASxMZEvpe5WDXFIb

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	5c61dda2091051594a6103c86222a97e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 2924	380	5c61dda2091051594a6103c86222a97e_JaffaCakes118.exe	86
PID 380 wrote to memory of 2924	380	5c61dda2091051594a6103c86222a97e_JaffaCakes118.exe	86
PID 380 wrote to memory of 2924	380	5c61dda2091051594a6103c86222a97e_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\5c61dda2091051594a6103c86222a97e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5c61dda2091051594a6103c86222a97e_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:380
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Krz..bat" > nul 2> nul
  2⤵
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Krz..bat

Filesize
238B

MD5
90ddc85f1ce84a7aaae4ec837e10bd60

SHA1
c2bf80d656511ee42d8c64050240ffbbecf2dcde

SHA256
f7926b9c252c094533bc93b6c3c1e2b4466d1ca5b8920b34ba5c4480fa9c112a

SHA512
e94fc65cb989459e1ce300366c367b712d2d2a7e1da0252f7c0c4c7ef3ba3bd7049a47624958673d26a001b2c0ace452eff00d2b6b56adee11113c90602c1d94

Download Submit
memory/380-0-0x0000000000402000-0x0000000000403000-memory.dmp

Filesize
4KB

Download
memory/380-2-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/380-1-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/380-3-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/380-5-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download